Share this page!

Objective-See Profile picture
Twitter logo
Jan 26 • 4 tweets • 4 min read
👾 New Blog Post: Analyzing OSX.DazzleSpy

Discovered by @ESET, DazzleSpy is a fully-featured cyber-espionage macOS implant, installed via a remote Safari exploit ☠️

The targets?
Pro-democracy supporters in Hong Kong.

Read: Analyzing OSX.DazzleSpy
objective-see.com/blog/blog_0x6D…
@ESET's blog post (written by @marc_etienne_ & @cherepanov74) on DazzleSpy is a must read!

...especially for details on the Safari exploit used to remotely deliver the malware! 🍎🐛

welivesecurity.com/2022/01/25/wat…
If you want to play along, we've also uploaded a DazzleSpy sample to our public macOS malware collection. #SharingIsCaring

👾 objective-see.com/downloads/malw… (pw: infect3d)
And yes, Objective-See's free, open-source tools (objective-see.com/products.html) have no problem detecting & thwarting this malware, even with no a priori knowledge of this threat! 😇

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Objective-See

Objective-See Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @objective_see

Objective-See Profile picture
Dec 22, 2021
⚠️ In macOS 12 (beta 6), Apple patched an intriguing flaw. Discovered by Gordon Long (@ethicalhax), CVE-2021-30853 allowed attackers to bypass:

▫️Gatekeeper
▫️Notarization
▫️File Quarantine

Interested in exactly how?

Read: "Where's the Interpreter!?"
objective-see.com/blog/blog_0x6A…
In short, unsigned, non-notarized script-based applications would be allowed if their script did *not* specify an interpreter! 🤯🤣

Meaning attackers could trivially bypass a myriad of foundational macOS security mechanisms via:

#!
<any malicious commands>
The issue begins in user-mode, where xpcproxy invokes posix_spawnp to launch the interpreter-less script-based application.

This initially errors out (no interpreter → ENOEXEC), but then posix_spawnp "recovers" and (re)executes the script ...this time directly via /bin/sh:
Read 5 tweets
Objective-See Profile picture
Nov 11, 2021
Google uncovered a sophisticated attack that leveraged both iOS & macOS exploits (n-/0-days) to infect Apple users! 👀

Interested in a triage of the macOS implant (named OSX.CDDS), including:
▫️ Installation
▫️ Persistence
▫️ Capabilities

📝 Have a read:
objective-see.com/blog/blog_0x69…
Of course, we're sharing a sample (as always) + the binaries/modules dropped by the implant 😇 #SharingIsCaring

👾 Download: objective-see.com/downloads/malw… (pw: infect3d)
Also be sure to also read:

1️⃣ Google's Threat Analysis Group (TAG) authoritative analysis on the attack/exploits: blog.google/threat-analysi…

2️⃣ @lorenzofb's excellent writeup
vice.com/en/article/93b…

📝🙌🏽
Read 5 tweets
Objective-See Profile picture
Sep 15, 2021
⚠️ A new malware campaign is targeting Mac users via sponsored search results & poisoned installers.

📝 Blog post analyzes stealthy trojanization mechanism, 2nd & 3rd stage payloads, and more!

+ samples! 😇

Read:
objective-see.com/blog/blog_0x66…

H/T @CodeColorist for discovery! 🙏
Original discovery: zhuanlan.zhihu.com/p/408746101 🙌
...and (as always?) LuLu has got you covered 😍 Image
Read 4 tweets
Objective-See Profile picture
May 17, 2021
[ #OBTS News ]

Objective by the Sea v4.0 (2021):
objectivebythesea.com/v4/

👨‍🏫 Training: 09/28 - 09/29
💬 Presentations: 09/30 - 10/01

📍 Location: Maui, Hawaii, USA

Can't wait to see y'all in lovely Maui!! ☀️🌴
...more details (venue, registration, etc.) soon!
#OBTS v4.0 Call For Papers now open!

Themes of interest are 🍎-security topics, such as:
⚙️ OS internals
🦠 Malware analysis
🛠️ Tool making & breaking
🐛 Bug discovery & exploitation

CFP details: objectivebythesea.com/v4/cfp.html
We've selected the newly remodeled beachside Westin Resort & Spa, in Ka'anapali Maui to host #OBTS v4.0🏖️ 😎

We've also secured a block of rooms at a massively discounted group rate. These will sell out, so don't wait (too long)!

More info / to book: objectivebythesea.com/v4/attending.h… ImageImageImageImage
Read 7 tweets
Objective-See Profile picture
Apr 26, 2021
A massive bug, affecting all recent versions of macOS was actively exploited as an 0day by malware 👾🍎

Read our blog post, #100
"All Your Macs Are Belong To Us"
objective-see.com/blog/blog_0x64…
PoC.gif 🔥
The majority of Mac infections are "user-assisted", which Apple combats via:
✅Notarization
✅Gatekeeper
✅File Quarantine
...these have proven problematic for attackers

But oops, this bug sidesteps all, allowing unsigned (unnotarized) items to be launched ...with no alerts!😭
Read 9 tweets
Objective-See Profile picture
Mar 19, 2021
Today, @SentinelOne published a report on "XcodeSpy", a new macOS malware specimen. 🍎👾

📝 "New macOS malware XcodeSpy Targets Xcode Developers": labs.sentinelone.com/new-macos-malw…

Q: Can our free open-source tools protect you ...with no a priori knowledge of this insidious threat?
When the malicious script in the infected Xcode project is executed and attempts to connect to the attacker's remote C&C server for tasking (via /bin/bash), LuLu will intercept this, and alert you:
If we allow the malicious payload (EggShell), to be downloaded from the server ....when it attempts to persistently install itself as a Launch Agent, BlockBlock will alert you:
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @objective_see has new unrolls!

Check out other threads from @objective_see!

Read all threads by @objective_see

:(